docs(agents): record how to install phpstan in remote sessions

[lisachenko]

Why

Every fresh Claude Code on the web session of this repo installs dependencies from source (slow) and then fails composer install on phpstan/phpstan. This PR records the diagnosis and the verified workarounds in tests/AGENTS.md, with a one-line pointer from the root AGENTS.md.

Diagnosis

• The session's GitHub proxy serves api.github.com zipballs, codeload and archive URLs only for repositories attached to the session. Every other package's dist download gets 403 "GitHub access to this repository is not enabled for this session", with or without a token, so no composer auth setting can open it.
• Composer falls back to source per package (a full git clone). Anonymous git reads of public repos pass the proxy, so the install works but takes 70 to 85 seconds with ~80 failed dist attempts.
• phpstan/phpstan publishes dist only: packagist metadata and composer.lock carry "source": null (its composer.json declares an empty source block deliberately; the code lives in phpstan/phpstan-src). No fallback, so the whole install aborts with "Could not authenticate against github.com".

Recipes recorded

• Fix A (primary): composer config -g repos.packagist composer https://mirrors.cloud.tencent.com/composer, drop the stale lock, composer install. The mirror hosts its own dist zips, is current with packagist, and its zips are byte-identical to the GitHub tags (phpstan.phar sha256 checked against the git tag and the release asset). Fresh install: ~30 s, 83 archives extracted, 0 fallbacks. Aliyun, Huawei and packagist.jp were tested and do not serve dists.
• Fix B (fallback): shallow-clone the phpstan release tag over git, git archive it into composer's dist cache under sha1(dist url), then composer install --prefer-source.

Validated from a clean state (no vendor, no lock, empty dist cache) for both fixes: install succeeds and composer analyze reports no errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X2syVMk85L4eCjMRbdAjJQ

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.00%. Comparing base (3cbf646) to head (824a96e).
⚠️ Report is 15 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master     #660       +/-   ##
=============================================
+ Coverage     85.40%   96.00%   +10.60%     
- Complexity     1636     1637        +1     
=============================================
  Files            99       99               
  Lines          4509     4510        +1     
=============================================
+ Hits           3851     4330      +479     
+ Misses          658      180      -478     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.